Epic Goal

• Support RHEL-9 cluster nodes

Why is this important?

• OCP is transitioning to RHEL-9 and because our content uses a ton of MachineConfig remediations, we need to make sure those support RHEL-9

Scenarios

1. As an OCP admin, I want to upgrade from OCP version based on RHEL-8 to an OCP version based on RHEL-9 while keeping my cluster compliant
2. As an OCP admin, I want to install a fresh OCP cluster based on RHEL-9 and make it compliant

Acceptance Criteria

• All our shipped profiles must support both RHEL-9 and RHEL-8
• Our CaC CI must test both
• Any discrepancies between RHEL 8 and RHEL 9 should be documented as control guidance, so it's discoverable by customers at runtime

Dependencies (internal and external)

1. OCP must be installable with RHEL-9 for us to be able to test the remediations

Previous Work (Optional):

1. The CaC team has been busy working on RHEL-9 STIG draft. Chances are we can reuse a lot of the investigation work, at least.

Open questions::

1. Do we need to rebuild the openscap container atop RHEL-9 or even keep both as long as OCP supports both RHEL-8 and RHEL-9? I don't think so, but worth checking with the openscap team

Done Checklist

• CI - CI is running, tests are automated and merged.
• Release Enablement <link to Feature Enablement Presentation>
• DEV - Upstream code and tests merged: <link to meaningful PR or GitHub Issue>
• DEV - Upstream documentation merged: <link to meaningful PR or GitHub Issue>
• DEV - Downstream build attached to advisory: <link to errata>
• QE - Test plans in Polarion: <link or reference to Polarion>
• QE - Automated tests merged: <link or reference to automated tests>
• DOC - Downstream documentation merged: <link to meaningful PR>